Private browsing: A window of forensic opportunity

Abstract

The release of Internet Explorer 10 marks a significant change in how browsing artifacts are stored in the Windows file system, moving away from well-understood Index.dat files to use a high performance database, the Extensible Storage Engine. Researchers have suggested that despite this change there remain forensic opportunities to recover InPrivate browsing records from the new browser. The prospect of recovering such evidence, together with its potential forensic significance, prompts questions including where and when such evidence can be recovered, and if it is possible to prove that a recovered artefact originated from InPrivate browsing. This paper reports the results of experiments which answer these questions, and also provides some explanation of the increasingly complex data structures used to record Internet activity from both the desktop and Windows 8 Applications. We conclude that there is a time window between the private browsing session and the next use of the browser in which browsing records may be carved from database log files, after which it is necessary to carve from other areas of disk. It proved possible to recover a substantial record of a user's InPrivate browsing, and to reliably associate such records with InPrivate browsing.

When finding nothing may be evidence of something: Anti-forensics and digital tool marks

“…A problem with the term AF is that it is used to arbitrarily categorize all software and hardware which at any given time thwarts DF investigatory processes, regardless of intention and malice. Whilst there are tools designed specifically with the goal of being AF, this can also be achieved as a by-product of many legitimate privacy enhancing software features, for example private browsing modes which may reduce the presence of Internet browsing history on a system (Said et al, 2011;Marrington et al, 2012;Chivers, 2014). The issues surrounding the defining of AF can be seen in the work of Al Fahdi et al, (2013) who note that 'arguably both encryption and steganography are a form of Anti-forensics'.…”

Survey on Android Forensic Tools and Methodologies

“…UFED physical analyzer which analyzes every segment of a device's memory using advanced logical, file system and physical extractions. Using simple stand-alone method with UFED, an examiner can recover MMS/SMS messages, call logs, photos, video, and contact information [13]. UFED mainly focuses on logical extraction only.…”

Navigating the Windows Mail database

“…2 Detailed study of how a Windows application uses ESE has a wider benefit for forensic practitioners than the application itself, since an understanding of how ESE is used provides valuable insights into other applications that use the database, and continuity between applications often means that study of an application provides a good basis for understanding its successor. For example, the study of how Internet Explorer 10 used ESE (Chivers, 2014) applies equally to the Edge browser, and provides insights into how Windows Apps store Internet data.…”